/etc/dhcp/dhclient-enter-hooks.d/resolved should not run in non-root network namespaces

[Steffan Karger]

Running dhclient in a (non-root) network namespace on a system with systemd enabled fails because the hook installed by the systemd package updates the DNS configuration of the core/root namespace, instead of simply the /etc/resolv.conf file of that particular network namespace.

("ip netns add <name>" nicely links /etc/resolv.conf in that namespace to /etc/netns/<name>/resolv.conf if it exists.)

The following patch ensures that this script no longer misbehaves for this scenario:

--- /etc/dhcp/dhclient-enter-hooks.d/resolved.bak 2020-07-21 14:05:23.390989468 +0200
+++ /etc/dhcp/dhclient-enter-hooks.d/resolved 2020-07-21 14:03:18.566046842 +0200
@@ -14,7 +14,7 @@
 # (D) = master script downs interface
 # (-) = master script does nothing with this

-if [ -x /lib/systemd/systemd-resolved ] ; then
+if [ -x /lib/systemd/systemd-resolved ] && [ -z "$(ip netns identify)" ] ; then
         # For safety, first undefine the nasty default make_resolv_conf()
         make_resolv_conf() { : ; }
         case "$reason" in

[Steffan Karger (syzzer)]

Gah, the -n should of course be a -z.

[Nick Rosbrook (enr0n)]

I don't think that script is or was part of src:systemd?

[Steffan Karger (syzzer)]

You' re right. It's provided by isc-dhcp-client. Can' t recall how I ended up with reporting this against systemd 4 years ago.